/**
 * Licensed to the Apache Software Foundation (ASF) under one or more
 * contributor license agreements.  See the NOTICE file distributed with
 * this work for additional information regarding copyright ownership.
 * The ASF licenses this file to You under the Apache License, Version 2.0
 * (the "License"); you may not use this file except in compliance with
 * the License.  You may obtain a copy of the License at
 *
 * http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

package net.sourceforge.stripes.authentication;

import org.apache.commons.codec.binary.Hex;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.security.MessageDigest;
import java.util.Random;

/**
 * @author Stefan Arentz
 */

public class DigestAuthenticationResolution extends AbstractAuthenticationResolution
{
    /**
     *
     */

    public DigestAuthenticationResolution(String realm)
    {
        super(realm);
    }

    /**
     * @see net.sourceforge.stripes.action.Resolution#execute(javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse)
     */

    public void execute(HttpServletRequest request, HttpServletResponse response) throws Exception
    {
        // TODO I've removed domain here, do we really need it?

        response.setHeader(
            "WWW-Authenticate",
            String.format(
                "Digest realm=\"%s\", nonce=\"%s\", algorithm=\"MD5\", qop=\"auth\"",
                getRealm(), generateRandomNonce()
            )
        );

        response.sendError(HttpServletResponse.SC_UNAUTHORIZED);
    }

    /**
     *
     */

    private String generateRandomNonce() throws Exception
    {
        Random random = new Random();
        MessageDigest md = MessageDigest.getInstance("MD5");

        byte[] bytes = new byte[4];
        for (int i = 0; i < 8; i++) {
            random.nextBytes(bytes);
            md.digest(bytes);
        }

        return new String(Hex.encodeHex(md.digest()));
    }
}
